The Latest Cost of the Target Hack: $153 Million Worth of New Credit Cards

A month and a half after news first broke about the massive breach of Target's debit and credit card data, the hits keep on coming. US banks have already replaced more than 15.3 million potentially compromised cards, which cost banks some $10 a piece to replace.

That whopping $153 million figure comes from the Consumer Bankers Association, which it says includes the cost of printing and mailing new cards, along with the administrative and mailing costs of notifying customers and activating their new cards.

The 15 million-odd cards replaced by CBA banks is still just a fraction of the total haul; Brian Krebs wrote in December that data on 40 million individual cards had been compromised in the hack—later estimates pegged the total number of customers potentially vulnerable at 110 million—which capped off the worst year on record for data breaches.

The complete replacement of cards was made necessary by the hackers' ability to crack encrypted PIN data, a story Reuters broke on Christmas Eve after a week of denials made by Target. As Consumerist explained a couple weeks ago, JPMorgan Chase took immediate action to replace two million customer cards, while Citi followed a month later, saying it didn't want to disrupt holiday shopping.

Both banks are affiliated with the CBA, and it's clear that such a massive replacement effort would be extremely costly. But do cards really cost $10 to replace? The CBA said that it arrived at that number based on average data reported by its member banks, and includes "the card itself, informing consumers of a card reissuement, shipping and activating the card, and often supplemental communication (usually via a call center)."

The cards aren't particularly expensive on their own. An interesting creditcards.com story pegs the price of manufacturing and shipping a card at $1.11. At this very moment, you could hop on Alibaba and order millions of blank credit cards from Chinese manufacturers for between $0.10 and $1.00 a pop, depending on volume and extra features like ID chips.

Add in expedited shipping, for which banks charge customers between $8 and $30, and administrative costs, and the CBA's $10 per card estimate doesn't appear completely unreasonable. It's still likely a bit high: the Minneapolis Star-Tribune says $4 to $5 per card is the figure "often cited," although these are obviously extenuating circumstances.

Either way, we're talking about tens of millions of dollars at least, costs that banks haven't passed onto customers. Will they pass it on to Target? The CBA has said it expects Target to pay, and the Star-Tribune notes that following a 2007 data breach, retail giant TJX Companies Inc. paid a total of $64 million to settle litigation, including a "$40 million payment to Visa Inc. and Fifth Third Bank."

In any case, it's more potential cost for the beleaguered retailer, which struggled to contain the breach and the ensuing, ongoing media storm. But Target has at least one big entity on its side: according to Reuters, the US Attorney General's office today confirmed it would be investigating the hackers responsible for the massive breach.

@derektmead